state of ipsec

[Tobias Roth]

On Sat, Feb 14, 2004 at 09:18:19PM +0000, Bruce M Simpson wrote:
> On Sat, Feb 14, 2004 at 06:41:44PM +0100, Tobias Roth wrote:
> > I unsuccessfully tried to get ipsec and racoon working on 5.2-RELEASE-p2.
> > Despite a setup that is proven to be correct, i don't see any outgoing
> > packets whatsoever during phase1, which then results in a timeout.
> > I know there have been issues with ipsec but i lost track of what got fixed
> > for wich tag.
> 
> Have you tried using setkey -D to inspect the 'last used' timestamp present
> on Security Associations?

yes, setkey -D never outputs anything, no SAs get created at all.

> Are you able to tcpdump ESP/AH traffic on both peers? Can you verify that
> the path between both peers doesn't filter this traffic?

that's what i was trying to say. tcpdump does not show any outgoing packets
when doing phase 1, no packets leave the interface. it looks like this:
security policies are correctly set, racoon is configured correctly and
running, i start pinging, and no packets leave the interface. i drop the
security policies (/etc/rc.d/ipsec forcestop), and the pings immediately
get through. in racoon output this looks like phase 1 gets initiated but
since no reply packets come back, it timeouts. i have no packet filter
running.